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Remarks/Arguments 

The Office Action mailed September 3, 2008 has been reviewed and carefully 
considered. No new matter has been added. Claims 1, 4, 7, 10, 13, and 16-19 have been 
amended. Claim 2 has been cancelled without prejudice. Claims 1 and 3-19 are pending 
in this application. Reconsideration of the application, in view of the above amendments 
and the following remarks, is respectfully requested. 

Claims 1, 2, 4, and 6-15 stand rejected under 35 U.S.C. §101 for being directed to 
non-statutory subject matter. 

With respect to Claims 1, 2, 4 and 6, the Examiner has stated that these claims 
lack the necessary physical articles or objects to constitute a machine or manufacture. 
Claim 1 has been amended and now recites " an indicator device for providing a plurality 
of user discemable indicators ". In order for the indicator device to provide a plurality of 
user discernable indicators, such device would conceivably have to provide an audible, 
visual, or tactile indicator, all of which would require hardware such as, for example, a 
speaker, a monitor, and a vibration device, respectively. In fact, the Applicant's 
specification describes the indicator as, for example, a light emitting diode (LED) (p. 5, 
line 21) and/or a speaker (p. 5, line 23). Hence, Claim 1, along with Claims 2, 4 and 6 
which depend from Claim 1, involve hardware, falling into at least one of the following 
statutory classes: machine; and manufacture. 

In rejecting Claims 7-15 under 35 U.S.C. §101, the Examiner stated that these 
claims are nothing more than an abstract idea that is not a practical application producing 
a useful, concrete, and tangible result. Claim 7 has been amended to now recite, inter 
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alia, "providing a user discernable notification of said violation by triggering at least one 
of the plurality of user discernable indicators". Thus, claim 7 is directed to a method that 
produces a useful and tangible result, namely, providing a user discernable notification of 
a violation by triggering at least one of a plurality of user discernable indicators. Hence, 
Claim 7, along with Claims 8-15 which depend from Claim 7, produces a useful, 
concrete, and tangible result. Accordingly, all claims pending in this application are 
believed to satisfy 35 U.S.C. § 101. Reconsideration of the rejection is respectfully 
requested. 

Claims 1-4 and 6-15 stand rejected under 35 U.S.C. § 102(e) as being anticipated 
by U.S. Patent Publication No. 2002/0133586 0133586 to Shanklin et al. (hereinafter 
"Shanklin"). Claim 5 stands rejected under 35 U.S.C. § 103(a) as being unpatenable over 
Shanklin in view of United States Patent Publication No. 2002/0080784 to Krumel 
(hereinafter "Krumel"). Claims 16 and 19 stand rejected under 35 U.S.C. §103(a) as 
being unpatentable over Shanklin in view of U.S. Patent No. 6,185,624B1 to Fijolek et al. 
(hereinafter "Fijolek"). Claims 17 and 18 stand rejected under 35 U.S.C. §103(a) as 
being unpatentable over Shanklin and Fijolek as applied to Claim 16, and further in view 
of Krumel. 

It is respectfully asserted that none of the cited references either taken singly or in 
any proper combination, teach or suggest the following limitations now recited in 
amended Claim 1 : 
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a firewall including a set of rules for identifying packets associated 
with inappropriate activity, the rules in the set being separated into a 
plurality of classes; and 

an indicator device for providing a plurality of user discernable 
indicators, wherein each of the plurality of user discernable indicators is 
associated with a different one of the plurality of classes, and wherein a 
respective one of said plurality of user discernable indicators is triggered if 
one or more of said plurality of rules corresponding to one of said plurality 
of classes associated with the respective one of said plurality of user 
discernable indicators is violated 

Furthermore, it is respectfully asserted that none of the cited references either 
taken singly or in any proper combination, teach or suggest the following limitations now 
recited in amended Claim 7: 

separating the rules in the set into a plurality of classes; 

associating each of the plurality of classes with a different one of a 
plurality of user discernable indicators; 

examining data traffic to determine whether at least one of the 
rules has been violated; and 

in the case that at least one of the rules of a first one of said 
plurality of classes has been violated, filtering said data traffic violating 
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the at least one of the rules of the first one of said plurality of classes and 
providing a user discemable notification of said violation by triggering a 
respective one of the plurality of user discernable indicators associated 
with the first one of said plurality of classes 

Moreover, it is respectfully asserted that none of the cited references either taken 
singly or in any proper combination, teach or suggest the following limitations now 
recited in amended Claim 16: 

a firewall program including a set of rules for identifying packets 
associated with inappropriate activity, the rules being separated into a 
plurality of classes, said firewall program being resident in said memory 
and executable by said controller to cause examining data of packets from 
said downstream and upstream circuitry; and 

a plurality of user discernable indicators, wherein each of the 
plurality of user discernable indicators is associated with a different one of 
the plurality of classes and wherein a respective one of said plurality of 
user discernable indicators is triggered if one or more of the rules 
corresponding to one of said plurality of classes associated with the 
respective one of said plurality of user discernable indicators is violated 



10 



Customer No. 24498 PATENT 
Serial No.: 10/517,574 PU020277 
Office Action Dated: September 3, 2008 
Response Dated: November 5, 2008 

In rejecting Applicant's claims in the Office Action dated September 09, 2008, 
the Examiner primarily relied on the Shanklin reference. Applicant's invention can be 
distinguished from this reference is several respects. 

The invention in Shanklin relates to monitoring data traffic and preventing the 
transmission of harmful data across data ports (Title; Paragraph [0002]). With respect to 
the TLIDS embodiment of his invention, Shanklin teaches that an alert may sent to a 
system administrator or a device after detecting unauthorized data packets (Paragraph 
[0073]). However, Shanklin fails to teach or suggest a notification system which requires 
"a plurality of user discernable indicators" to notify the user of inappropriate activity or 
harmful data. 

Furthermore, Shanklin fails to teach or suggest "separating the rules into a 
plurality of classes". In the Office Action, the Examiner rejected Claim 2 stating 
"Shanklin teaches that an activity is determined using a plurality of rules divided into 
classes (set of attack parameters) indicative of levels of appropriateness [0074]." 
However, the Examiner's reliance on paragraph [0074] as showing such is misplaced. 
Paragraph [0074] of Shanklin teaches that a user can define certain rules, i.e., the attack 
parameters, for identifying an attack. However, this passage fails to show that these rules 
should be separated into a plurality of classes. Moreover, Shanklin fails to teach or 
suggest that each class is assigned a separate indicator that is triggered when a rule within 
the class has been violated. 

Fijolek and Krumel also fail to teach or suggest the above-recited limitations of 
Claims 1, 7, and 16, and hence do not cure the deficiencies of Shanklin. Fijolek relates to 
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a management system for a cable modem on a data-over-cable system (col. 1, lines 6-8). 
It appears that the Examiner cited Fijolek to show a cable modem being used as a mid- 
switching device. However, Fijolek teaches little, if anything with respect to user 
discernable indicators or alerts. Therefore, Fijolek, like Shanklin, fails to teach the above 
recited limitations found in Claims 1, 7, and 16. 

Krumel relates to PLD-based communication protocols for transmitting, receiving 
and configuring data across networks ([0001]). With respect to alerts, Krumel teaches 
sending an alert in response to an attack on the data protection system ([01 16]). The 
reference teaches that a single multi-colored LED can be used as such alert ([0116]). 
However, Krumel does not teach or suggest anything with respect to separating rules into 
classes or assigning separate indicators to each class of rules and triggering the specific 
indicator associated with a class upon a determination that a rule within the class has 
been violated. 

Accordingly, the combined teachings of all of the cited references fail to teach or 
suggest all of the elements found in Claims 1, 7 and 16. Therefore, Claims 1, 7 and 16 are 
patentably distinct over the cited references. Moreover, "[i]f an independent claim is 
nonobvious under 35 U.S.C. 103, then any claim depending therefrom is nonobvious" 
(MPEP §2143.03, citing In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988)). 

All other claims depend from Claim 1, 7 or 16, or a claim which itself is 
dependent from one of these claims. Thus, these claims include all of the elements found 
in the claims from which they depend. Accordingly, these claims are also patentably 
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distinct over the cited references for at least the reasons set forth above with respect to 
independent Claims 1,7, and 16. 

In view of the foregoing, Applicants respectfully request that the rejection of the 
claims set forth in the Office Action of September 3, 2008 be withdrawn and that the 
pending claims be allowed. 

No fee is believed due with regard to the filing of this amendment. However, if a fee 
is due, please charge Deposit Account No. 07-0832. 
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Patent Operations 
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Respectfully submitted, 
Brian Albert Wittman 
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